chore: pin mcp>=1.28.1,<2 ahead of MCP Python SDK v2 stable release (#5840)

The MCP Python SDK v2 stable release (targeted 2026-07-27/28) is a major
rework with pervasive breaking changes (FastMCP rename, mcp.types split,
WebSocket transport removal). Upstream guidance is to add a <2 upper bound
before the release. Bound every first-party manifest and regenerate uv.lock;
resolution stays on the 1.28.x line. fastmcp needs no change: its own mcp
dependency is intersected with our direct <2 pin.

Closes #5839

Signed-off-by: Ahmad Al Tamimi <altamimi.dev@gmail.com>

Author: Altamimi-Dev

mcp-servers/python/data_analysis_server/pyproject.toml

@@ -10,7 +10,7 @@ readme = "README.md"
 requires-python = ">=3.11"
 dependencies = [
     "matplotlib>=3.11.0",
-    "mcp>=1.28.1",
+    "mcp>=1.28.1,<2",
     "numpy>=2.4.4",
     "openpyxl>=3.1.5",
     "orjson>=3.11.9",

mcp-servers/python/data_analysis_server/requirements.txt

@@ -1,5 +1,5 @@
 matplotlib>=3.11.0
-mcp>=1.28.1
+mcp>=1.28.1,<2
 numpy>=2.5.1
 openpyxl>=3.1.5
 pandas>=3.0.3

mcp-servers/python/mcp_eval_server/pyproject.toml

@@ -29,7 +29,7 @@ dependencies = [
     "diskcache>=5.6.3",
     "httpx>=0.28.1",
     "jinja2>=3.1.6",
-    "mcp>=1.28.1",
+    "mcp>=1.28.1,<2",
     "numpy>=2.4.4",
     "openai>=2.44.0",
     "orjson>=3.11.9",

mcp-servers/templates/python/{{cookiecutter.project_slug}}/pyproject.toml

@@ -9,7 +9,7 @@ license = { text = "{{ cookiecutter.license }}" }
 readme = "README.md"
 requires-python = ">={{ cookiecutter.python_min }}"
 dependencies = [
-  "mcp>=1.0.0",
+  "mcp>=1.0.0,<2",
   "orjson>=3.11.5",
   "pydantic>=2.5.0",
 ]

plugins/external/cedar/pyproject.toml

@@ -45,7 +45,7 @@ authors = [
 
 dependencies = [
     "cedarpy>=4.8.7",
-    "mcp>=1.28.1",
+    "mcp>=1.28.1,<2",
     "mcp-contextforge-gateway>=1.0.6",
 ]
 

plugins/external/llmguard/pyproject.toml

@@ -45,7 +45,7 @@ authors = [
 
 dependencies = [
     "llm-guard>=0.3.16",
-    "mcp>=1.28.1",
+    "mcp>=1.28.1,<2",
     "orjson>=3.11.9",
     "rapidfuzz>=3.14.5",
     "redis>=8.0.1",

plugins/external/opa/pyproject.toml

@@ -45,7 +45,7 @@ authors = [
 
 dependencies = [
     "httpx>=0.28.1",
-    "mcp>=1.28.1",
+    "mcp>=1.28.1,<2",
     "mcp-contextforge-gateway>=1.0.6",
 ]
 

pyproject.toml

@@ -121,7 +121,7 @@ dependencies = [
     "jsonpath-ng>=1.8.0",
     "jsonschema>=4.26.0",
     "Mako>=1.3.12", # Transitive pin (alembic)
-    "mcp>=1.28.1",
+    "mcp>=1.28.1,<2",
     "msgpack>=1.2.1",
     "orjson>=3.11.9",
     "parse>=1.22.1",